release

A release checklist for publishing a new version of Maestro, a software tool, with its version, changelog, branch, tag, and published command-line package updated consistently.

In plain words
What is it for?
Use it to propose a version, update release records, prepare a release pull request, merge and tag an approved release, publish the CLI, and verify it.
Why use it?
It prevents an untested or accidentally premature release by checking prior cloud deployment, requiring version and approval decisions, and verifying the result after publishing.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/mobile-dev-inc/maestro/release
Any agent
npx skills add mobile-dev-inc/Maestro --skill release
Clone the repo
git clone --depth 1 https://github.com/mobile-dev-inc/Maestro

Made for: Claude Code, Codex.

Per session 66 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,526 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00066 $0.05526
Opus 5 $0.00033 $0.02763
Sonnet 5 $0.00013 $0.01105
Haiku 4.5 $0.00007 $0.00553

Measured 2d ago against content hash ff9931b8ff70, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

release scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

PATH="$NOBREW" HOME="$TMP" MAESTRO_DIR="$TMP/.maestro" bash -c 'curl -Ls "https://get.maestro.mobile.dev" | bash'

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

PATH="$NOBREW" HOME="$TMP" MAESTRO_DIR="$TMP/.maestro" bash -c 'curl -Ls "https://get.maestro.mobile.dev" | bash'
.claude/skills/release/SKILL.md · 314 lines

How it starts

The opening of the file, as written. The whole thing — 314 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Release Maestro

This is the release doc for the Maestro repo. There is no other one: RELEASING.md points here.

Policy

  • The commit you release must already have been deployed to Maestro Cloud and run there for about a day. How that happens is not this repo's business; maintainers know. The skill asks you to confirm it and takes your word.
  • Two human checkpoints. The version is a judgment call and it gets baked into the changelog, both gradle.properties, the branch, the commit, the PR title, and the tag — so you confirm it before any of that is written (Checkpoint 1). Then everything is drafted into a PR, and you say go once (Checkpoint 2); after that the skill merges, tags, publishes the CLI, and verifies without asking again. Nothing lands on main before Checkpoint 2.
  • Checkpoint 2 comes after the PR is approved and required checks are green. main requires one approving review and passing required checks (the e2e suite is one). The checklist asks you to get both before you say go; the skill checks them once and merges — it doesn't wait or poll.
  • Propose the version, don't ask for it. Read the commits since the last release and recommend a bump with the Semver rubric. The human confirms or overrides at Checkpoint 1; they own the call, the skill just does the arithmetic and makes the case.
  • Don't wait for Maven Central. Pushing the tag triggers publish-release.yaml; it runs on its own and the CLI publish doesn't depend on it.
  • Don't announce. publish-cli.yaml makes jreleaser publish a GitHub release; notify-release-comms.yml fires on that and mobile-dev-inc/release-comms DMs the releaser to start the announcement flow.
  • Downstream is not described here. Maestro Cloud and Studio pick up the tag through their own processes.

Inputs

Input Default Notes
version propose The skill proposes X.Y.Z (no v) from the commits since the last tag using the Semver rubric, and you confirm or override at Checkpoint 1. If the invocation names a version, use it — but still map the commits and flag a mismatch at Checkpoint 1 (e.g. the number says minor, the commits are all fixes).
sha origin/main HEAD Always print the resolved full sha. It must equal origin/main HEAD. It's here so you can confirm which commit is being released, not so you can pick an older one.
dry-run off Only when the invocation explicitly says "dry run". Never offer it as an option or ask about it. In dry-run the skill drafts locally and stops at Checkpoint 2, then runs Dry-run cleanup; it never pushes, opens a PR, tags, or dispatches a workflow.

Read the full file on GitHub · 314 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 314 lines · 66 tokens per session scan C ff9931b8ff70

Subscribe to this mod's changes

release is a skill published in the GitHub repository mobile-dev-inc/Maestro (15,456 stars, last pushed 4d ago), licensed Apache-2.0. It adds 66 tokens to every session and 5,526 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories